Recently I needed to check for all scheduled task running on servers using a certain account as the password needed to be updated.  To search for these scheduled task I used schtask.exe

https://docs.microsoft.com/en-us/windows/win32/taskschd/schtasks

I wanted to integrate this with PowerShell so that I could do some connection tests, loop through a list of devices and output the results to CSV.  Below is the script I created it has three mandatory parameters for the computer list, run as account and export path.

## Set script parameter
param(
[parameter(Mandatory = $true)]
[String]$CompList,
[parameter(Mandatory = $true)]
[String]$RunAsAccount,
[parameter(Mandatory = $true)]
[String]$ExportLocation
)
## Get list of device to check
$comps = Get-Content $CompList

## Loop through each device
foreach ($comp in $Comps){
Write-Host “Testing connection to $($comp)” -ForegroundColor DarkGreen
$TC = Test-Connection $comp -Count 1 -ErrorAction SilentlyContinue

if ($TC){
Write-Host “Checkig $($comp)” -ForegroundColor Green

## Check scheduled task for specified run as account
$schtask = schtasks.exe /query /V /S $comp /FO CSV | ConvertFrom-Csv | Select-Object HostName,TaskName,Status,”Next Run Time”,”Run As User” |
Where-Object {$_.”Run As User” -contains $RunAsAccount}
if ($schtask){

## Export results
Write-Host “Task found exporting to results to $($ExportLocation)”
$schtask | Export-Csv “$ExportLocation\ScheduledTaskExport.csv” -NoTypeInformation -Append
}
else {
Write-Host “No task found with run as account”
}

}
else {
Write-Host “$($comp) not responding Exporting failures to log file located in $($ExportLocation)” -ForegroundColor Yellow
$comp | Out-File “$ExportLocation\FailureReport.log” -NoTypeInformation -Append
}
}

To run the script supple the three parameter like below. I used Check_RunAsAccount as the scrip name.

.\Check_RunAsAccount.ps1 -CompList D:\Scripts\Task_Scheduler\Complist.txt -RunAsAccount test1 -ExportLocation D:\Scripts\Task_Scheduler\

Once the script has completed there will be a result csv and if there are any non responding devices there will be a second csv.The export result will look like the below. 

In the last post we went through deploying the LAPS agent using a script, GPO or SCCM. The next step is to configure the GPO settings to apply LAPS management policy’s

First, we create a new GPO to apply the LAPS management policy’s, the LAPS policy’s are under Computer Configuration > Polices > Administrative Templates > LAPS (If this doesn’t show the ADMX template is probable missing and will need to be installed. This can be done using the LAPS installer)Password settings policy used to set the password complexity, length and ageSpecify the account that the password policy will apply to if this is the default administrator account this should be left at defaultEnabled management of local admin accountOnce the policy is configured apply the policy against the required OUTo confirm that all settings are working, run a gpupdate on a test device. Once applied we can check the password in a few different ways

First way is to run PowerShell command:

Second way is to use the LAPS UI , this can be either used from the management server or installed on local computer using the LAPS installer and selecting the LAPS management tools

The third method is to check the AD computer attribute ms-Mcs-AdmPwd:

Last step is to set delegated access to a security group or set of users to view and reset the local administrator password. Use the below command to verify the current rights

Find-AdmPwdExtendedRights -identity:OU distinguishedName

There are two command to set the rights, one for read and one for reset rights

Set-AdmPwdReadPasswordPermission -OrgUnit OU distinguishedName -AllowedPrincipals “HelpDesk_LAPS_Access”

Set-AdmPwdResetPasswordPermission -OrgUnit OU distinguishedName -AllowedPrincipals “HelpDesk_LAPS_Access”

Last step is to verify the permission have been applied

LAPS is now deployed and ready to use.